Skip to content

Security

Security model

Every Portuna product follows the same rules: your keys stay with you, funds move only to your addresses, and the code that moves them is small, verifiable and immutable. Below is how Portuna Sweep keeps them.

Our three rules

  1. 01

    Your keys stay with you

    We never create or hold the keys to your addresses. You sign in your own HSM, KMS or MPC; we never see a key.

  2. 02

    Funds go only where you allow

    To an address written into an immutable contract, or with your signature on a specific operation. Anyone can check the code, and it has no admin keys.

  3. 03

    Pay per success, less than today

    You pay only for operations that succeed, priced against a published benchmark you can check. Our fee never makes an operation cost more than it does you today.

Products

Portuna Sweep

The first product. Your keys, your hot wallet, your gas wallet: three small contracts that can do one thing and cannot be changed.

Non-custodial

Deposit keys never leave your custody. A deposit address signs one thing: an EIP-7702 authorization that puts your delegate's code on it, on one chain. You sign it in your own HSM, KMS or MPC; we never see the key.

Funds go from the deposit address straight to your hot wallet, inside the batch transaction. They never pass through an address of ours.

The key keeps working: you can send from a deposit address as before, and revoke the delegation at any time to turn it back into a plain address.

Three small contracts

Immutable, ownerless, without upgrades or admin roles. Each partner gets its own batcher and delegates, so no contract of ours touches two partners.

  • SweepFactory

    Shared and ownerless; the same address on every chain. It deploys a partner's batcher and delegates, always for the caller's own gas wallet.

  • SweepBatcher

    Yours. Accepts batches only from your gas wallet and walks the deposits one by one: a failing address is skipped and reported, the batch goes through.

  • SweepDelegate

    The code on your deposit addresses, one per hot wallet. It does one thing: send a token or the native coin to the hot wallet written into its bytecode, when your batcher asks.

Who can do what

Who Can Cannot
You Everything you could before: the deposit keys are yours. Revoke the delegation at any time. —
Our relayer Send batches of your sweeps from your gas wallet. Send funds anywhere but your hot wallet.
Us, as a company Decide when a batch goes out. Change your hot wallet: it is part of the delegate's code.
Someone with your gas wallet's key Sweep your deposits early — into your own hot wallet — and spend the gas wallet's balance. Take funds from deposit addresses or from your hot wallet.
Anyone else, other partners included Nothing: the delegate obeys only your batcher. Trigger, redirect or block your sweeps.

Verify before you sign

All contracts are created with CREATE2, so an address is a hash of the creator, the salt and the full creation code — bytecode and constructor arguments. Change a single byte and the address changes. If the address computed from the open code matches the one on-chain and there is code there, it is exactly that code, with exactly your hot wallet and gas wallet.

verify-delegate, part of the Go and TypeScript SDKs, does it in one command before any deposit signs: it computes the factory, your batcher and your delegate, checks their code on-chain and compares the delegate with the one the API returned.

Factory on the testnets

The address changes with any change of the code; the mainnet address will be published at launch.

Gas wallet keys

Gas wallet keys live in a separate signing service, the only component that can sign. The API servers never see them.

The signer signs only transactions to the shared factory, to your own batcher and to the one address your fees are settled to. It stays within per-network gas caps and a daily budget per gas wallet, and keeps a journal of every signature and refusal. Even a full compromise of the API servers could only burn gas within that budget — never move funds from deposits or your hot wallet.

Before mainnet

The contracts' source code will be published, and every mainnet deployment verified on Etherscan and Sourcify.

Report a vulnerability

Found a weakness? Write to us before disclosing it publicly. We answer every report.

support@portuna.example
Testnet live · mainnet soon

Try it on testnet today

Self-serve on Sepolia and BSC testnet. Mainnet access opens soon — tell us about your volumes and we'll get you ready.

Start on testnet Talk to us